GitHub Advisoryadvisory · Go

GHSA-33c5-9fx5-fvjm Privilege Escalation in Kubernetes

MEDIUM Published 2024-04-24 Modified 2024-05-20 Official page ↗
Aliases
CVE-2020-8559
Ecosystem
Go
Packages
k8s.io/apimachinery, k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-601
Reviewed
2024-04-24

Affected packages

• Go k8s.io/apimachinery: < 0.16.13 → fixed in 0.16.13 • Go k8s.io/apimachinery: >= 0.17.0, < 0.17.9 → fixed in 0.17.9 • Go k8s.io/apimachinery: >= 0.18.0, < 0.18.7 → fixed in 0.18.7 • Go k8s.io/kubernetes: < 1.16.13 → fixed in 1.16.13 • Go k8s.io/kubernetes: >= 1.17.0, < 1.17.9 → fixed in 1.17.9 • Go k8s.io/kubernetes: >= 1.18.0, < 1.18.7 → fixed in 1.18.7

Description

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Related

Alias · CVE (1)

  • CVE-2020-8559 The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References